One Security Lesson Microsoft Learned Well